Analysis
-
max time kernel
141s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2023 20:14
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe
-
Size
72KB
-
MD5
d11dc55ce642ed9dfa207bcb69ec5a00
-
SHA1
69fa8f78617d511fa5fed3fbb762b5c703f7425a
-
SHA256
5526f6872f6fe578b031535911d0d08c6580ccd1cfb412c2888f09b01a8adc04
-
SHA512
2d9fd7a905a9da5f5a09860e6516c293d0c572e7a71f078065decfd874c235295e9038c7b1cda92b239ef66c4fe5d6a5ec6ec0bee105e84af739ce1261e7d57d
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6Qptwyv:G6zqhyYtkYW/CPnO3ajwyv
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3132 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.execmd.execmd.exedescription pid process target process PID 4660 wrote to memory of 2944 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 4660 wrote to memory of 2944 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 4660 wrote to memory of 2944 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 4660 wrote to memory of 3132 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe MediaCenter.exe PID 4660 wrote to memory of 3132 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe MediaCenter.exe PID 4660 wrote to memory of 3132 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe MediaCenter.exe PID 2944 wrote to memory of 3712 2944 cmd.exe reg.exe PID 2944 wrote to memory of 3712 2944 cmd.exe reg.exe PID 2944 wrote to memory of 3712 2944 cmd.exe reg.exe PID 4660 wrote to memory of 2544 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 4660 wrote to memory of 2544 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 4660 wrote to memory of 2544 4660 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2544 wrote to memory of 1564 2544 cmd.exe PING.EXE PID 2544 wrote to memory of 1564 2544 cmd.exe PING.EXE PID 2544 wrote to memory of 1564 2544 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3132 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5e945528159cb19f380c9c46cdb7c7f6f
SHA1c76de97cfdd4526fc1e36834c972aa4dae69ed69
SHA25670e112255ea8a96b59cf25691a5b50e4b4a6763a0187c76160147a00d2e52f62
SHA5122cde1c7fb0a2beaf9088c00ff35b76f5749e7817c45bf480dfb5ca5e7415362cec8c7ccc9949757a3922c9d589beba46f9e37f8cb7526a656a403a5235a96e86
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5e945528159cb19f380c9c46cdb7c7f6f
SHA1c76de97cfdd4526fc1e36834c972aa4dae69ed69
SHA25670e112255ea8a96b59cf25691a5b50e4b4a6763a0187c76160147a00d2e52f62
SHA5122cde1c7fb0a2beaf9088c00ff35b76f5749e7817c45bf480dfb5ca5e7415362cec8c7ccc9949757a3922c9d589beba46f9e37f8cb7526a656a403a5235a96e86
-
memory/3132-8-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4660-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4660-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4660-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4660-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB